feat: add admin panel with user, tag, and signup management

Phase 4 — Admin Panel:
- Admin dashboard with user/fave/pending-request counts
- User management: create with temp password, reset password,
  enable/disable accounts (prevents self-disable)
- Tag management: rename and delete tags
- Signup request management: approve (creates user with
  must-reset-password) and reject pending requests
- Site settings: site name, description, signup mode
  (open/requests/closed)
- All admin routes require both login and admin role
- SignupRequest model and full store (create, list pending,
  approve with user creation, reject)
- SetMustResetPassword method on UserStore for admin password resets

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/pages/admin_requests.html

@@ -0,0 +1,44 @@
+{{define "head"}}
+<meta name="robots" content="noindex">
+{{end}}
+
+{{define "content"}}
+<h1>Registreringsforespørsler</h1>
+
+{{with .Data}}
+    {{if .Requests}}
+        <table role="grid">
+            <thead>
+                <tr>
+                    <th scope="col">Brukernavn</th>
+                    <th scope="col">Sendt</th>
+                    <th scope="col">Handlinger</th>
+                </tr>
+            </thead>
+            <tbody>
+                {{range .Requests}}
+                <tr>
+                    <td>{{.Username}}</td>
+                    <td>{{.CreatedAt.Format "02.01.2006 15:04"}}</td>
+                    <td>
+                        <form method="POST" action="{{basePath}}/admin/signup-requests/{{.ID}}" class="inline-form">
+                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                            <input type="hidden" name="action" value="approve">
+                            <button type="submit" class="outline primary nav-button">Godkjenn</button>
+                        </form>
+                        <form method="POST" action="{{basePath}}/admin/signup-requests/{{.ID}}" class="inline-form">
+                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                            <input type="hidden" name="action" value="reject">
+                            <button type="submit" class="outline secondary nav-button"
+                                    onclick="return confirm('Avvis forespørselen fra «{{.Username}}»?')">Avvis</button>
+                        </form>
+                    </td>
+                </tr>
+                {{end}}
+            </tbody>
+        </table>
+    {{else}}
+        <p>Ingen ventende forespørsler.</p>
+    {{end}}
+{{end}}
+{{end}}